Tornado Cash Co-Founder Convicted: Implications for DeFi Privacy

A Manhattan jury has found Roman Storm, co-founder of the cryptocurrency mixer Tornado Cash, guilty of conspiracy to operate an unlicensed money transmitting business. While the jury couldn't reach a verdict on money laundering and sanctions violations charges (with the DOJ potentially pursuing a new trial), this conviction sends shockwaves through the crypto community, raising serious questions about developer liability and the future of on-chain privacy.

The Case Against Storm

Tornado Cash, launched in 2019, is an open-source, non-custodial crypto mixer designed to obfuscate transaction trails. Prosecutors argued that Storm knowingly facilitated money laundering, citing the platform's use by malicious actors, including the North Korean hacking group Lazarus Group. Witnesses for the prosecution, including FBI and IRS officers as well as hackers, testified that Storm had the capability to prevent misuse but chose not to act. The defense argued that developers shouldn't be held liable for how others use their code. They called on Ethereum core developer Preston Van Loon and NAXO co-founder Matthew Edman, among others, to defend Storm.

OFAC Sanctions and Legal Battles

The case began when the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash in August 2022, alleging it laundered over $7 billion in crypto, including $455 million stolen by Lazarus Group. Although a federal appeals court initially ruled that OFAC overstepped its authority and the Treasury lifted sanctions in March 2025, the criminal charges against Storm persisted, culminating in this recent verdict.

Crypto Community Rallies Behind Storm

Storm has maintained that developers should be free to write code without fear of consequences arising from third-party misuse. This sentiment is shared by many in the crypto space, including Ethereum co-founder Vitalik Buterin, who reportedly conceived the idea for Tornado Cash in discussions with Storm. Supporters have contributed over $3 million to Storm's legal defense, highlighting the significance of this case to the wider DeFi community.

Bitwise research analyst Danny Nelson has called the verdict "a disaster for DeFi developers," raising the question of how much control developers have over how their code is used.

Key Takeaways:

• Roman Storm found guilty of unlicensed money transmitting; other charges pending possible retrial.
• The case raises concerns about developer liability for open-source code.
• The conviction could have a chilling effect on DeFi innovation and privacy-enhancing technologies.
• The crypto community largely supports Storm, viewing the case as a threat to decentralization.